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DETAILED ACTION 
Response to Amendment 

1 . This action is in response to amendments received 12/23/2005. 

Response to Arguments 

2. Applicant's arguments/amendments with respect to previously presented claims 
2-4, and 6 - 10, amended claims 1 and 5, and withdrawn claims 11-17, filed 
December 23, 2005 have been fully considered (MPEP 714.04; 37 CFR 1.111) but they 
are not persuasive. Amendments to claims 1 and 5 have been accepted and therefore 
the objection and rejection are withdrawn. The Examiner would like to point out that this 
action is made final (see MPEP 706.07a). 

With regard to applicant's argument that Holloway et al. does not suggest, "at 
least one of the nodes having an identification assigned thereto based on a logical 
assignment grouping one or more of the plurality of nodes , each node sharing an 
identification being commonly vulnerable to at least one network exploit ", Examiner 
respectfully disagrees. The Examiner believes a hub to .be a device that connects 
several other devices or nodes (e.g. computers) to a network. Therefore it would be 
inherent in Holloway et al. that each hub links a grouping of nodes within the campus 
LAN environment. The logical assignment of such nodes is first by building (i.e. 
administration building and dormitory) then by floors and department. The hub of each 
nodes is understood to be the common identification/access point for which vulnerability 
would be shared (see Figure 16 and column 15, lines 47 - 67). 

Claim Rejections - 35 USC § 102 
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The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

3. Claims 1 -10 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Holloway, et al. in US Patent 5,905,859 (hereinafter US '859). 

As it pertains to Claim 1 , US '859 teaches: 
A network having an intrusion protection system (see column 2, lines 54 - 55), 
comprising: 

a network medium (see column 17, lines 66-67)] 

a management node connected to the network medium and running an intrusion 
prevention system management application (see column 18, lines 32 - 33; where the 
network management station is the management node and it is inherent that a detection 
means application is running)] and 

a plurality of nodes connected to the network medium and running an instance of 
an intrusion protection system application (see Figure 16; where each managed hub 
signifies a node), at least one of the nodes having an identification assigned thereto 
based on a logical assignment grouping one or more of the plurality of nodes, each 
node sharing an identification being commonly vulnerable to at least one network exploit 
(see column 3, lines 4 - 5; where the MAC address is the ID and each node has an 
authorized address). 

For Claim 2, US '859 teaches: 
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The network according to claim 1, wherein the management node is operable to 
originate a security update that is transmitted to each node sharing the identification, 
any remaining nodes not sharing the identification being excluded from receiving the 
update (see column 8, lines 8 -10; where each nodes copies the group address). 

For Claim 3, US '859 teaches: 
The network according to claim 1, wherein a plurality of identifications are respectively 
assigned to one or more of the plurality of nodes (see Figure 16; where each hub is in a 
differing location that can be used as a form of identification (e.g. building, department, 
floor)). 

For Claim 4, US '859 teaches: 
The network according to claim 1, wherein the identification is an Internet Protocol 
multicast group identification (see column 2, line 61; where the ID is a multicast/group 
address also referred to as the LAN security feature group address). 

For Claim 5, US '859 teaches: 
The network according to claim 2, further comprising: 

a plurality of network mediums (see column 17, lines 66-67)\ and 

at least one router (see Figure 16), the management node and the plurality of 
nodes each respectively connected to one of the plurality of network mediums in the 
network, the router disposed intermediate the plurality of network mediums and 
operable to forward the security update from the network medium having the 
management node connected thereto to any nodes connected to the remaining network 
mediums and sharing the identification (see column 15, lines 34 - 38). 
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For Claim 6, US '859 teaches: 
The network according to claim 5, wherein the router determines whether any of the 
plurality of nodes connected to the remaining network mediums share the identification 
through implementation of the Internet group management protocol (see column 15, 
lines 30 - 32). 

For Claim 7, US '859 teaches: 
The network according to claim 1 , wherein the network medium is an Ethernet (see 
column 15, lines 50 - 51). 

For Claim 8, US '859 teaches: 
The network according to claim 1, further comprising a network-based intrusion 
protection system appliance dedicated to filtering inbound and outbound data frames 
transmitted across the network medium (see column 18, lines 10- 13; where the 
discovery request/response frames act as inbound and outbound frames). 

For Claim 9, US '859 teaches: 
The network according to claim 8, wherein the network-based intrusion protection 
system appliance interfaces with the network medium via a network interface card 
operating in promiscuous mode (see Figure 3 and column 5, line 16). 

For ClaimlO, US '859 teaches: 
The network according to claim 8, wherein the network-based intrusion protection 
system appliance shares the identification (see column 18, lines 1 - 4; where a list is 
maintained). 



Application/Control Number: 1 0/001 ,446 Page 6 

Art Unit: 2132 

Conclusion 

4. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Laurel Lashley whose telephone number is 571-272- 
0693. The examiner can normally be reached on Monday - Thursday, alt Fridays btw 
7:30 am & 5 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron, Jr. can be reached on 571-272-3799. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 



Application/Control Number: 10/001,446 



Page 7 



Art Unit: 2132 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
Laurel Lashley 
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